@oxygen-agent/cli 1.1010.650 → 1.1010.905

package/node_modules/@oxygen/shared/dist/plan-capabilities.d.ts

@@ -25,14 +25,22 @@
  * live in docs/free-tier-capability-matrix.md.
  *
  * WHY GATES ARE CHECKED BEFORE BALANCE. A connected sender is also a FIXED
- * monthly credit commitment (1,000 per mailbox, 10,000 per LinkedIn account,
- * 10,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
- * workspace could buy 10,000 credits for $12.50 and fund a LinkedIn seat that
+ * monthly credit commitment (100 per mailbox, 1,000 per LinkedIn account,
+ * 1,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
+ * workspace could buy 1,000 credits for $12.50 and fund a LinkedIn seat that
  * Starter prices at $99. Enforcing by balance would therefore price sending at
  * an eighth of Starter. The capability gate must run BEFORE any balance or
  * commitment check so the customer is told to upgrade, not to top up.
+ *
+ * THE 2026-09 REPRICING ENDS THAT ARGUMENT (decision 2.7). Connected accounts
+ * are repriced as credit reservations at their real price, so once they are
+ * billed that way (the credit gate, `OXYGEN_CREDIT_GATE_ENABLED`) credits are the
+ * only gate and the sending walls retire: `CREDIT_GATE_RETIRED_CAPABILITIES`.
+ * Until the gate is in force everything above still holds.
  */
-import type { PlanTier } from "./billing.js";
+import type { PlanTier, PricingPlanDefinition } from "./billing.js";
+import { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate } from "./credit-gate.js";
+import { type RepricingOptions } from "./repricing.js";
 export declare const PLAN_GATED_CAPABILITIES: readonly ["sender_connect", "sequence_dispatch", "publishing_connect", "publishing_deliver", "managed_email_infrastructure", "byok_provider_keys"];
 export type PlanGatedCapability = (typeof PLAN_GATED_CAPABILITIES)[number];
 /**
@@ -56,14 +64,76 @@ export type PlanGatedCapabilityCopy = {
 export declare const PLAN_GATED_CAPABILITY_COPY: Record<PlanGatedCapability, PlanGatedCapabilityCopy>;
 export declare function isPlanGatedCapability(value: unknown): value is PlanGatedCapability;
 /**
- * The whole boundary, in one expression.
+ * The walls credits replace once the credit gate is in force (repricing
+ * 2026-09, decision 2.7, slice S22).
+ *
+ * "Credits are the only gate": a free workspace may connect accounts, send,
+ * publish and buy managed infrastructure if it holds the credits. Each of these
+ * is paid for by a monthly credit reservation or a credit purchase, so the plan
+ * wall has nothing left to protect — but only once those reservations are
+ * actually BILLED, which is exactly what the credit gate asserts at boot
+ * (`assertCreditGateArmed`). Until then every one of them stays walled exactly
+ * as before.
+ *
+ * Two capabilities stay walled under the gate:
+ * - `byok_provider_keys`: bringing your own keys needs a plan that includes it
+ *   ($99 or above from the repricing's effective date).
+ * - `publishing_connect`: the only publishing connects that still reach it are
+ *   Instagram, TikTok, YouTube and Facebook, which have no reservation price yet
+ *   (P-18). Connecting them without one would make them free and unmetered, so
+ *   they stay on the plan until that price is ratified.
+ */
+export { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate };
+/**
+ * The whole boundary for one plan, in one expression.
  *
- * Note this asks about the TIER, not about entitlement. A churned workspace and
+ * Note this asks about the PLAN, not about entitlement. A churned workspace and
  * a brand-new one both resolve to `free` and both get the same answer here —
  * one entitlement, one capability set, differing only in grants and upgrade
  * copy (founder, 2026-08-17).
+ *
+ * BYOK reads the plan's own `byokEnabled`, never the tier: every Oxygen size
+ * shares the tier `oxygen`, and only $99 and above include BYOK once the
+ * repricing is in force. Everything else is the founder's one line, free versus
+ * paid. `creditGateInForce` retires the walls credits pay for (above).
+ */
+export declare function planAllowsCapability(plan: Pick<PricingPlanDefinition, "tier" | "byokEnabled">, capability: PlanGatedCapability, options?: {
+    creditGateInForce?: boolean;
+}): boolean;
+/**
+ * The smallest purchasable plan that includes BYOK right now: `oxygen_49` until
+ * the repricing's effective date, `oxygen_99` from it (decision 2.7).
  */
-export declare function planTierAllowsCapability(tier: PlanTier, _capability: PlanGatedCapability): boolean;
+export declare function byokMinimumPlanKey(options?: RepricingOptions): "oxygen_49" | "oxygen_99";
+/** How a refusal names `byokMinimumPlanKey` in a sentence: "a paid plan" or "the $99 plan or above". */
+export declare function byokMinimumPlanPhrase(options?: RepricingOptions): string;
+/**
+ * P-20 (PROPOSED default): a $49 workspace keeps using the keys it connected
+ * before the repricing's effective date until its plan changes; new keys need
+ * $99. True only for a connection made before an instant that has passed, on
+ * the plan key `oxygen_49` — any other plan either includes BYOK or never did.
+ *
+ * "Until the plan changes" is read from the current plan key: a move off $49
+ * ends the grandfathering. No plan-change history is stored, so a workspace that
+ * leaves $49 and comes back after the date is not told apart from one that
+ * stayed; only keys connected before the date ever qualify.
+ */
+export declare function byokConnectionGrandfathered(input: {
+    planKey: string | null | undefined;
+    connectionCreatedAt: Date | string | null | undefined;
+}, options?: RepricingOptions): boolean;
+/**
+ * The access requirements of a tool that runs ONLY on the customer's own key.
+ *
+ * One definition for the provider catalog, the Composio catalog and both access
+ * resolvers. The tier list is display metadata: every paid tier has at least one
+ * plan with BYOK, and whether THIS plan has it is `plan.byokEnabled`, which the
+ * access resolver checks separately.
+ */
+export declare function byokOnlyAccessRequirements(): {
+    byok_required: true;
+    required_plan_tiers: PlanTier[];
+};
 export declare const FREE_TIER_ENTITLEMENT_ENABLED_ENV_VAR = "OXYGEN_FREE_TIER_ENTITLEMENT_ENABLED";
 /**
  * Fail-closed rollout switch for capability-scoped entitlement.

package/node_modules/@oxygen/shared/dist/plan-capabilities.js

@@ -25,13 +25,21 @@
  * live in docs/free-tier-capability-matrix.md.
  *
  * WHY GATES ARE CHECKED BEFORE BALANCE. A connected sender is also a FIXED
- * monthly credit commitment (1,000 per mailbox, 10,000 per LinkedIn account,
- * 10,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
- * workspace could buy 10,000 credits for $12.50 and fund a LinkedIn seat that
+ * monthly credit commitment (100 per mailbox, 1,000 per LinkedIn account,
+ * 1,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
+ * workspace could buy 1,000 credits for $12.50 and fund a LinkedIn seat that
  * Starter prices at $99. Enforcing by balance would therefore price sending at
  * an eighth of Starter. The capability gate must run BEFORE any balance or
  * commitment check so the customer is told to upgrade, not to top up.
+ *
+ * THE 2026-09 REPRICING ENDS THAT ARGUMENT (decision 2.7). Connected accounts
+ * are repriced as credit reservations at their real price, so once they are
+ * billed that way (the credit gate, `OXYGEN_CREDIT_GATE_ENABLED`) credits are the
+ * only gate and the sending walls retire: `CREDIT_GATE_RETIRED_CAPABILITIES`.
+ * Until the gate is in force everything above still holds.
  */
+import { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate } from "./credit-gate.js";
+import { OXYGEN_49_BYOK_REPRICING, readRepricingSwitch, repricedValue, } from "./repricing.js";
 export const PLAN_GATED_CAPABILITIES = [
     "sender_connect",
     "sequence_dispatch",
@@ -94,15 +102,87 @@ export function isPlanGatedCapability(value) {
         && PLAN_GATED_CAPABILITIES.includes(value));
 }
 /**
- * The whole boundary, in one expression.
+ * The walls credits replace once the credit gate is in force (repricing
+ * 2026-09, decision 2.7, slice S22).
+ *
+ * "Credits are the only gate": a free workspace may connect accounts, send,
+ * publish and buy managed infrastructure if it holds the credits. Each of these
+ * is paid for by a monthly credit reservation or a credit purchase, so the plan
+ * wall has nothing left to protect — but only once those reservations are
+ * actually BILLED, which is exactly what the credit gate asserts at boot
+ * (`assertCreditGateArmed`). Until then every one of them stays walled exactly
+ * as before.
+ *
+ * Two capabilities stay walled under the gate:
+ * - `byok_provider_keys`: bringing your own keys needs a plan that includes it
+ *   ($99 or above from the repricing's effective date).
+ * - `publishing_connect`: the only publishing connects that still reach it are
+ *   Instagram, TikTok, YouTube and Facebook, which have no reservation price yet
+ *   (P-18). Connecting them without one would make them free and unmetered, so
+ *   they stay on the plan until that price is ratified.
+ */
+export { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate };
+/**
+ * The whole boundary for one plan, in one expression.
  *
- * Note this asks about the TIER, not about entitlement. A churned workspace and
+ * Note this asks about the PLAN, not about entitlement. A churned workspace and
  * a brand-new one both resolve to `free` and both get the same answer here —
  * one entitlement, one capability set, differing only in grants and upgrade
  * copy (founder, 2026-08-17).
+ *
+ * BYOK reads the plan's own `byokEnabled`, never the tier: every Oxygen size
+ * shares the tier `oxygen`, and only $99 and above include BYOK once the
+ * repricing is in force. Everything else is the founder's one line, free versus
+ * paid. `creditGateInForce` retires the walls credits pay for (above).
+ */
+export function planAllowsCapability(plan, capability, options = {}) {
+    if (options.creditGateInForce && isCapabilityRetiredByCreditGate(capability))
+        return true;
+    if (capability === "byok_provider_keys")
+        return plan.byokEnabled;
+    return plan.tier !== "free";
+}
+/**
+ * The smallest purchasable plan that includes BYOK right now: `oxygen_49` until
+ * the repricing's effective date, `oxygen_99` from it (decision 2.7).
+ */
+export function byokMinimumPlanKey(options = {}) {
+    return repricedValue(OXYGEN_49_BYOK_REPRICING, options) ? "oxygen_49" : "oxygen_99";
+}
+/** How a refusal names `byokMinimumPlanKey` in a sentence: "a paid plan" or "the $99 plan or above". */
+export function byokMinimumPlanPhrase(options = {}) {
+    return byokMinimumPlanKey(options) === "oxygen_99" ? "the $99 plan or above" : "a paid plan";
+}
+/**
+ * P-20 (PROPOSED default): a $49 workspace keeps using the keys it connected
+ * before the repricing's effective date until its plan changes; new keys need
+ * $99. True only for a connection made before an instant that has passed, on
+ * the plan key `oxygen_49` — any other plan either includes BYOK or never did.
+ *
+ * "Until the plan changes" is read from the current plan key: a move off $49
+ * ends the grandfathering. No plan-change history is stored, so a workspace that
+ * leaves $49 and comes back after the date is not told apart from one that
+ * stayed; only keys connected before the date ever qualify.
+ */
+export function byokConnectionGrandfathered(input, options = {}) {
+    if (input.planKey !== "oxygen_49" || !input.connectionCreatedAt)
+        return false;
+    const state = readRepricingSwitch(options);
+    if (state.status !== "in_force")
+        return false;
+    const createdAt = new Date(input.connectionCreatedAt).getTime();
+    return Number.isFinite(createdAt) && createdAt < state.effectiveAt.getTime();
+}
+/**
+ * The access requirements of a tool that runs ONLY on the customer's own key.
+ *
+ * One definition for the provider catalog, the Composio catalog and both access
+ * resolvers. The tier list is display metadata: every paid tier has at least one
+ * plan with BYOK, and whether THIS plan has it is `plan.byokEnabled`, which the
+ * access resolver checks separately.
  */
-export function planTierAllowsCapability(tier, _capability) {
-    return tier !== "free";
+export function byokOnlyAccessRequirements() {
+    return { byok_required: true, required_plan_tiers: [...PLAN_GATE_QUALIFYING_TIERS] };
 }
 export const FREE_TIER_ENTITLEMENT_ENABLED_ENV_VAR = "OXYGEN_FREE_TIER_ENTITLEMENT_ENABLED";
 /**

package/node_modules/@oxygen/shared/dist/plan-limits-view.d.ts

@@ -0,0 +1,219 @@
+/**
+ * How `GET /api/cli/limits` reads to a person: the seven plan sizes side by
+ * side, the workspace's own spend defaults, and what the 2026-09 repricing
+ * schedule moves (decision F.2: the value in force and the value pending for
+ * it). The MCP `oxygen.plan-limits` widget and the web Settings → Plan limits
+ * tab both render from here, so the two cannot disagree on a label or a
+ * pending value. Pure and browser-safe: it formats an envelope it is handed and
+ * reads nothing else.
+ */
+/** What a band's storage moves to (`plan_bands[].storage.target`, decision F.2). */
+export type PlanLimitsStorageTarget = {
+    table_row_limit?: number;
+    workspace_row_limit?: number;
+    workspace_database_limit_bytes?: number;
+    import_max_rows_per_file?: number;
+};
+export type PlanLimitsBandRow = {
+    band?: string;
+    label?: string;
+    limits_tier?: string;
+    current?: boolean;
+    monthly_price_usd?: number | null;
+    monthly_credits?: number | null;
+    volume_bonus_percent?: number | null;
+    usd_per_100_credits?: number | null;
+    api?: {
+        org_requests_per_minute?: number;
+        key_requests_per_minute?: number;
+        tenant_read_requests_per_key_per_minute?: number;
+        tenant_write_requests_per_key_per_minute?: number;
+        live_action_requests_per_key_per_minute?: number;
+    };
+    storage?: {
+        table_row_limit?: number;
+        workspace_row_limit?: number;
+        workspace_database_limit_bytes?: number;
+        import_max_rows_per_file?: number;
+        import_max_file_bytes?: number;
+        status?: string;
+        effective_at?: string | null;
+        target?: PlanLimitsStorageTarget | null;
+    };
+    spend?: {
+        trigger_run_credit_ceiling?: number | null;
+        auto_run_batch_credit_ceiling?: number | null;
+        agent_run_max_total_credits?: number;
+        copilot_approval_free_per_call_credits?: number;
+        copilot_approval_free_per_session_credits?: number;
+        org_daily_guard_block_credits?: number | null;
+        byok_column_run_max_rows?: number | null;
+    };
+    tables?: {
+        max_rows_per_write_request?: number;
+        max_columns_per_run?: number;
+    };
+    signals?: {
+        max_events?: number;
+        max_window_days?: number;
+    };
+    webhooks?: {
+        ingress_requests_per_target_per_minute?: number;
+    };
+    workflows?: {
+        cron_min_interval_minutes?: number;
+    };
+};
+export type PlanLimitsWorkflowLimits = {
+    cron_min_interval_minutes?: number;
+    code_node_max_timeout_seconds?: number;
+    run_attempt_timeout_minutes?: number;
+};
+export type PlanLimitsStorageCapacity = {
+    platform_guard?: {
+        table_row_limit?: number;
+        workspace_row_limit?: number;
+        workspace_database_limit_bytes?: number;
+    };
+    usage?: {
+        workspace_rows?: number | null;
+        largest_table_rows?: number | null;
+        largest_table?: {
+            id?: string;
+            name?: string;
+        } | null;
+        workspace_database_bytes?: number;
+    } | null;
+};
+export type PlanLimitsScheduledChange = {
+    key?: string;
+    kind?: string;
+    unit?: string;
+    description?: string;
+    value_before?: unknown;
+    value_after?: unknown;
+};
+export type PlanLimitsPricingSchedule = {
+    effective_at?: string;
+    status?: string;
+    changes?: PlanLimitsScheduledChange[];
+};
+type ChannelLimit = {
+    default_per_day?: number;
+    max_per_day?: number | null;
+};
+export type PlanLimitsSendingLimits = {
+    email_per_mailbox?: ChannelLimit;
+    whatsapp_per_number?: ChannelLimit;
+    voice_per_number?: ChannelLimit;
+    linkedin_per_account?: {
+        invites_per_day?: number;
+        invites_per_day_max?: number;
+        messages_per_day?: number;
+    };
+};
+export type PlanLimitsSpendDefaults = {
+    trigger_run_credit_ceiling?: number | null;
+    auto_run_batch_credit_ceiling?: number | null;
+    agent_run_max_total_credits?: number;
+    agent_run_max_inference_credits?: number;
+    /** The most a run approved above the default may spend (decision F.4). */
+    agent_run_approved_max_credits?: number;
+    copilot_approval_free_per_call_credits?: number;
+    copilot_approval_free_per_session_credits?: number;
+    copilot_attended_turn_backstop_credits?: number;
+    org_daily_spend_guard?: {
+        applies?: boolean;
+        source?: string;
+        warn_credits?: number | null;
+        block_credits?: number | null;
+        spent_today?: number | null;
+    };
+    applies_to?: Record<string, string>;
+};
+/** The slice of the `limits show` envelope this module reads. */
+export type PlanLimitsEnvelope = {
+    plan_band?: string;
+    plan_band_label?: string;
+    limits_tier?: string;
+    plan_bands?: PlanLimitsBandRow[];
+    sending_limits?: PlanLimitsSendingLimits;
+    workflow_limits?: PlanLimitsWorkflowLimits;
+    shared_billing?: boolean;
+    storage_capacity?: PlanLimitsStorageCapacity;
+    spend_safety_defaults?: PlanLimitsSpendDefaults;
+    pricing_schedule?: PlanLimitsPricingSchedule;
+    deepLink?: string;
+    web_url?: string;
+    billing_url?: string;
+};
+export declare function formatLimitCount(value: number | null | undefined): string;
+export declare function formatLimitCredits(value: number | null | undefined): string;
+export declare function formatLimitBytes(value: number | null | undefined): string;
+/**
+ * `storage.<band>.<field>` / `workflows.…` / `spend.…` / `agents.…` → the
+ * value it takes once the scheduled change is in force. Empty unless the
+ * schedule is still ahead (`status: "scheduled"`).
+ */
+export declare function scheduledLimitChanges(schedule: PlanLimitsPricingSchedule | undefined): Map<string, number>;
+export type PlanLimitsLadder = {
+    bands: Array<{
+        band: string;
+        label: string;
+        current: boolean;
+    }>;
+    rows: Array<{
+        label: string;
+        cells: string[];
+    }>;
+    /** What `→` and `†` mean, when a cell uses them. */
+    notes: string[];
+};
+/** Every plan size's limits side by side, with the pending value after `→`. */
+export declare function planLimitsLadder(payload: PlanLimitsEnvelope): PlanLimitsLadder;
+/**
+ * The workspace's own usage against the limits it enforces, so "how close am
+ * I?" sits beside "what would a bigger plan give me?". The largest Table is
+ * named, so a full one is identifiable (decision F.2).
+ */
+export declare function planLimitsStorageUsageLine(storage: PlanLimitsStorageCapacity | undefined): string | null;
+/** Sending limits are the same on every plan: one row per channel. */
+export declare function planLimitsSendingRows(sending: PlanLimitsSendingLimits | undefined): Array<{
+    label: string;
+    defaultPerDay: string;
+    maximumPerDay: string;
+}>;
+/**
+ * The Code step and run attempt limits are the same on every plan; the fastest
+ * schedule, which differs, is a row of the ladder.
+ */
+export declare function planLimitsWorkflowNote(workflows: PlanLimitsWorkflowLimits | undefined): string | null;
+export type PlanLimitsSpendDefaultRow = {
+    label: string;
+    value: string;
+    /** The value from the scheduled date, when one is set and it differs. */
+    next: string | null;
+    /** What the default bounds, from `spend_safety_defaults.applies_to`. */
+    scope: string | null;
+};
+/**
+ * The workspace's own spend defaults, each with what it bounds and the value
+ * it takes on the scheduled date (L5.1–L5.4). Read from the plan size the
+ * workspace is on (`plan_band`, `limits_tier`), so the pending value is the
+ * one this workspace will get.
+ */
+export declare function planLimitsSpendDefaults(payload: PlanLimitsEnvelope): PlanLimitsSpendDefaultRow[];
+export type PlanLimitsScheduleRow = {
+    key: string;
+    description: string;
+    before: string;
+    after: string;
+};
+export type PlanLimitsSchedule = {
+    effectiveAt: string;
+    inForce: boolean;
+    rows: PlanLimitsScheduleRow[];
+};
+/** Every price and limit the dated repricing moves, before and after. */
+export declare function planLimitsSchedule(schedule: PlanLimitsPricingSchedule | undefined): PlanLimitsSchedule | null;
+export {};